From 3877c97146867557da4cb1bbff8ae7978b7bf181 Mon Sep 17 00:00:00 2001
From: Codex <codex@noreply.local>
Date: Mon, 8 Jun 2026 04:55:09 +0000
Subject: [PATCH] fix: install hwlab render deps in temp clone

---
 scripts/hwlab-g14-contract-test.ts |  4 +++-
 scripts/src/hwlab-g14.ts           | 10 ++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/scripts/hwlab-g14-contract-test.ts b/scripts/hwlab-g14-contract-test.ts
index 3c0db3ce..65a30742 100644
--- a/scripts/hwlab-g14-contract-test.ts
+++ b/scripts/hwlab-g14-contract-test.ts
@@ -266,8 +266,10 @@ const sourceText = await Bun.file(new URL("./src/hwlab-g14.ts", import.meta.url)
 assertCondition(
   renderScript.includes("git clone --shared --no-checkout \"$cicd_repo\" \"$worktree_dir\"")
     && renderScript.includes("git -C \"$worktree_dir\" checkout --detach \"$source_commit\"")
+    && renderScript.includes("npm ci --ignore-scripts --no-audit --prefer-offline")
+    && renderScript.includes("bun install --frozen-lockfile --ignore-scripts")
     && renderScript.includes("/tmp/hwlab-v02-control-plane-source-aaaaaaaaaaaa-"),
-  "v0.2 control-plane render must use an isolated temp clone from the CI/CD repo so same-commit concurrent triggers do not share worktree metadata",
+  "v0.2 control-plane render must use an isolated temp clone with lockfile-based dependencies so same-commit concurrent triggers do not share worktree metadata",
   renderScript,
 );
 assertCondition(
diff --git a/scripts/src/hwlab-g14.ts b/scripts/src/hwlab-g14.ts
index 4e89268c..2ecfe53b 100644
--- a/scripts/src/hwlab-g14.ts
+++ b/scripts/src/hwlab-g14.ts
@@ -2813,6 +2813,16 @@ export function v02ControlPlaneRenderScript(sourceCommit: string, token = v02Ren
     "git -C \"$worktree_dir\" checkout --detach \"$source_commit\"",
     "test \"$(git -C \"$worktree_dir\" rev-parse HEAD)\" = \"$source_commit\"",
     "cd \"$worktree_dir\"",
+    "if [ ! -d node_modules/yaml ]; then",
+    "  if [ -f package-lock.json ]; then",
+    "    npm ci --ignore-scripts --no-audit --prefer-offline",
+    "  elif [ -f bun.lock ] || [ -f bun.lockb ]; then",
+    "    bun install --frozen-lockfile --ignore-scripts",
+    "  else",
+    "    echo \"v0.2 control-plane render cannot install dependencies: no lockfile found\" >&2",
+    "    exit 42",
+    "  fi",
+    "fi",
     `node scripts/g14-gitops-render.mjs --lane v02 --source-revision ${shellQuote(sourceCommit)} --out "$render_dir"`,
   ].join("\n");
 }